State processor for pattern matching in a network monitor device

Abstract

A processor for processing contents of packets passing through a connection point on a computer network. The processor includes a searching apparatus having one or more comparators for searching for a reference string in the contents of a packet, and processes contents of all packets passing through the connection point in real time. In one implementation, the processor is programmable and has an instruction set that includes an instruction for invoking the searching apparatus to search for a specified reference string in the packet starting at an unknown location within a range of the packet.

1. A processor configured to process contents of packets passing through a connection point on a computer network, the processor comprising:
 (a) a buffer for receiving at least some of the contents of each packet passing through the connection point; 
 (b) a memory containing one or more instructions of an instruction set for the state processor; 
 (c) an arithmetic logic unit (ALU) coupled to the buffer; 
 (d) a control block coupled to the ALU and to the instruction memory for decoding instructions; and 
 (e) a program counter coupled to the instruction memory and to the ALU for indicating the next state processor instruction in the memory to process, 
 
       wherein the ALU includes a searching apparatus comprising one or more comparators for searching for a reference string in the contents of a packet. 
     
     
       2. A processor according to  claim 1 , wherein the state processor processes contents of all packets passing through the connection point in real time. 
     
     
       3. A processor according to  claim 1 , wherein the instruction set includes an instruction for invoking the searching apparatus of the ALU to search for a specified reference string in the packet starting at an unknown location within a range of the packet. 
     
     
       4. A processor according to  claim 1 , wherein the searching apparatus searches for any of a set of reference strings in the contents of a packet, and wherein the instruction set includes an instruction for invoking the searching apparatus to search for any of a set of specified reference strings in the packet starting at an unknown location within a range of the packet.